Currently the LegacyProvider which handles ADFS/LDAP only supports adding users as 'enabled'. The SyncEngine does not react to users in the LegacyProvider who set to 'disabled' or 'deleted' thus disabled users do not get disabled in the SyncEngine and subsequently in the K2 identity cache.